Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)

2021-01-2000:00:00

Juan David Ordoñez Noriega

The plugin did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

The PoC will be displayed on April 16, 2021, to give users the time to update.

References

github.com/jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1

www.advancedcustomfields.com/blog/acf-5-9-1-release/

JSON

Related for WPEX-ID:D1E9C995-37BD-4952-B88E-945E02E3C83F